Making SIPRnet Easy

Securing network infrastructure prior to building occupancy

2011-07-12T13:22:00.000-04:00

In recent conversations with network security managers, we heard concerns about securing networks in newly constructed buildings, even before the network is turned on. The issue is that in new construction the network infrastructure is installed well before the building is occupied. During this period of time, from construction to occupancy, a device could be placed on the network cabling that would go unnoticed and could be used in the future to tap the data transmissions once the network is operating.

By installing INTERCEPTOR at the same time the network is installed, information assurance managers can be confident that the network infrastructure will not been compromised prior to turning up the network. INTERCEPTOR monitors dark (inactive) fibers, and with its remote monitoring capabilities, appropriate personnel are immediately alerted to any tampering with the installed infrastructure.

Tests prove INTERCEPTOR drastically reduces cost of PDS deployment

2011-06-15T10:56:00.000-04:00

To explore the full capabilities of the aforementioned patent, NIS engineers recently have confirmed through testing of a simulated network that a single INTERCEPTOR port can effectively secure at least 40 end user drops. This means that a 4-port INTERCEPTOR is capable of monitoring four separate circuits or zones serving up to 160 end-user connection points.

As a result, INTERCEPTOR, priced at approximately $22,000 GSA per unit, costs less than $150 per drop to deploy, exclusive of the cabling and, if required, the hardened PDS. In some cases, the Designated Approval Authority (DAA) will permit the use of INTERCEPTOR in combination with interlocking armored cable and eliminate the requirement for hardened PDS.

NIS awarded patent for PDS technology

2011-06-08T09:31:00.000-04:00

NIS has been awarded a patent for dark fiber monitoring of optic cables and hub and spoke monitoring architecture. This technology enables INTERCEPTOR to uniquely use two or more dark fibers (spare, inactive) in a multi-fiber cable to protect the entire cable against intrusion. The patent also describes a technique to protect connectivity to multiple end users with a single port or zone.

Combined, these technologies make INTERCEPTOR the most cost effective PDS alternative available. (For more information, see the INTERCEPTOR Design Guide)

Rapid Increase of INTERCEPTOR Installations

2011-04-14T15:04:00.000-04:00

The word is getting out … In 2010, NIS’ business grew by more than 5 times that of the year before! We want to thank our customers for contributing to our success!

Spring Conferences

2011-04-07T09:57:00.001-04:00

NIS will be exhibiting at the Tactical C4 Conference April 19-21 in Atlanta and at DoDIIS May 1-5 in Detroit, MI.

INTERCEPTOR Well Received at COMSEC and IAE

2011-03-30T14:42:00.001-04:00

Network Integrity Systems exhibited and discussed potential INTERCEPTOR applications with a number of military IA personnel at two recent conferences: the COMSEC Users Conference at Lackland AFB in February and the Information Assurance Expo (IAE) in Nashville in March. INTERCEPTOR was seen by attendees as a PDS solution that has the potential to change the way network security is handled. We demonstrated how INTERCEPTOR can be used in a point-to-multipoint architecture to allow high density, logically clustered groups of protected SIPR drops.

This results in cost reductions of 75% or greater when compared to legacy protection methods. In addition, without PDS to construct, secure network connections can be delivered in days instead of weeks. Since the secure network infrastructure is no longer obvious and the monitored cables therefore do not require human inspections to assure their security, the cables can be concealed above ceilings or below floors, improving facility aesthetics and enhanced security.

Making Sure Non-Compliant PDS Survives Growing Network Security Demands

2010-07-16T14:21:00.000-04:00

In our meetings and discussions with military network operators, we often hear concerns about bringing PDS into compliance and maintaining Authority to Operate (ATO). Operational requirements to expand secure connections have caused many DAAs to re-evaluate existing waivers for secure network infrastructure being protected by a non-compliant PDS. Many units are struggling to come up with a cost-effective, easy-to-implement solution.

While C4 networks are a critical asset and enabler for U.S. military and government operations, they are becoming more and more of a target for our enemies as well. Due to the increased reliance and dependence of military personnel on C4 networks to conduct operations, maintaining the security and availability of these networks is essential – which is why many historical waivers for PDS systems are being rescinded or scheduled to expire. As a result, many network security managers are facing the question of how to meet stringent new requirements with limited budgets and short timelines.

In many cases, the options for bringing network security up to standard present a choice between the use of encryption or making significant changes to the cable infrastructure and pathways. These approaches can be completely disruptive to existing operations and/or can cost a significant amount of money.

The Interceptor alarmed carrier PDS offers an easy and cost effective way to bring classified networks such as SIPRNet and JWICS into compliance.

The Interceptor is ideal for both outside plant and indoor applications. When monitoring building-to-building links, it provides persistent network security and eliminates the need for daily, mandatory manhole inspections and in locations where required, the need to encase the duct banks in concrete.

Inside the building, Interceptor can be added to existing cables carried in legacy hardened PDS and mitigates most issues of non-compliance due to its persistent monitoring for intrusions into the PDS. An added benefit is that the need for daily visual inspections is eliminated because the system is now considered an Alarmed Carrier Hardened Distribution System (Reference NSTISSI 7003).

How does this help with waivers that will not be renewed? With plug-and-play capability, Interceptor can be rapidly added to new or existing network infrastructure – making migration from a waivered PDS system to a fully compliant PDS system quick and cost effective.

For more information about Interceptor as a means for bringing PDS into compliance, visit http://www.networkintegritysystems.com/Non-Compliance%20PDS%20Emailer.pdf, and consult with your CTTA to ensure that any proposed system – hardened or alarmed – provides the necessary protection for unencrypted, classified national security information based upon your specific deployment.

Marine Corps IA conference coming up next week

2010-03-25T10:22:00.002-04:00

We’ll be heading to Palm Springs for the U.S. Marine Corp Information Assurance expo March 29-31, 2010. Visit us at booth #208 to see the Interceptor in action.

Representatives from Tyco Electronics will also be on hand to talk about their AMPTRAC intelligent infrastructure management system (IIMS). Network Integrity Systems is teaming with Tyco Electronics to provide advanced network infrastructure security. Come see Interceptor and AMPTRAC, and find out how they can be integrated to form a total solution.

More about the conference at http://www.technologyforums.com/10MC/.

Visit us at FOSE March 23-25

2010-03-16T10:44:00.000-04:00

Network Integrity Systems will be at the FOSE 2010 conference next week, March 23-25, in Washington, D.C. Stop by our booth #1325 to find out what’s new in alarmed carrier PDS technology and to see a live demo of the Interceptor PDS.

While at FOSE, be sure to visit Tyco Electronics at booth #2531. Tyco is now offering the Interceptor PDS to complement Tyco’s AMPTRAC intelligent infrastructure management system. Together, these systems deliver an unprecedented level of security for classified government networks.

For more information about FOSE, go to http://www.fose.com/.

Interceptor demo installed at General Dynamics Executive Briefing Center

2010-02-16T09:51:00.002-05:00

If you've been looking for an opportunity to see the Interceptor alarmed carrier PDS in action, now is your chance. A demo system has just been installed as an IT solution in the General Dynamics Executive Briefing Center in Rosslyn, Virginia. Network Integrity Systems worked with Global Com Inc., an installer of structured cabling systems, to integrate Interceptor at the facility.

The Executive Briefing Center was created to host state-of-the-art multi-media presentations and leading-edge technology demonstrations for customers and partners of General Dynamics located in the Capitol District. Interceptor, an alarmed carrier PDS that ensures the protection and availability of SIPRNet, JWICS and other classified networks transmitting national security information, is a good fit for the facility. The device facilitates increased collaboration and information sharing for anti-terrorism activities and ensures COOP and availability of command and control networks.

If you're not in the D.C. area but would like to see how the Interceptor works, we'll demo the device at a number of tradeshows this year. Look for us at:

FOSE
USMC-IA
PM NSC
LandWarNet
TechNet Asia-Pacific
NGB JITC

Fact Friday #3

2010-02-05T20:12:00.001-05:00

I’ll address FAQs Part 3:

Q. Am I required to contain the cables being protected by Interceptor inside a hardened carrier system (i.e. rigid metallic conduit, EMT or commercial raceway)? A: It depends on the organization. Air Force updated its PDS policy in 2009 to permit flexible interlocking armored optical cables monitored by Interceptor as a PDS (up to TS-CONUS, Secret-OCONUS). Army and Navy will consider the same solution on a project-by-project basis. This allows cables to be distributed in existing conveyance (wire basket, ladder rack) or suspended from D-rings, J-Hooks, etc., resulting in tremendous cost savings and construction complexity reduction. For non-armored cables, Interceptor permits at a minimum the installation of the conduit above the ceiling or below the floor since the requirement for periodic visual inspections is eliminated when an alarmed carrier PDS is used. The benefits are still significant: more reliable inspection of the PDS (performed by the Interceptor 24/7), and much better facility aesthetics.

Q. What types of management or software tools are required to manage the Interceptor? A: The Interceptor can be locally managed by serial console, and remotely managed by Telnet or Secure Shell (SSH). The INTERCEPTOR can be accessed via terminal programs such as HyperTerminal or TeraTerm.

Q. Doesn’t the requirement to respond to alarms create an additional need for manpower? A: Since Interceptor eliminates the requirements to perform daily visual inspections of the PDS, the resources formerly used to conduct that task are no longer needed. A key thing to remember is that Interceptor prompts you when to conduct an inspection versus conducting them day-in-and-day-out whether a threat to the network exists or not. Therefore the use of Interceptor actually reduces the manpower necessary to secure a network.

Q. Who typically monitors the Interceptor and how do they receive the alarms generated? A: Monitoring responsibility is established on an organization-by-organization basis. Typically it is performed by Secu¬rity/Military Police, IT Help Desks or Network Operations & Security Centers (NOSCs). If Security/Military Police forces are used, then the Interceptor is usually integrated via dry contact interfaces into the existing building security system, which those forces routinely monitor. If monitored by IT departments or NOSCs, then the alarms are usually received via SNMP traps.

Q. Which organizations have deployed Interceptor? A: As of this printing Interceptor has been deployed by the US Air Force, US Army, US Coast Guard, US Marine Corps, CENTCOM, Department of Homeland Security, Defense Intelligence Agency, Department of Justice, DoD Department of Inspector General, Naval Surface Weapons Center, Naval Undersea Warfare Center, National Reconnaissance Office, SPAWAR, STRATCOM, The Pentagon, numerous large and small systems integrators, major defense contractors.

If you have specific questions about Interceptor or alarmed carrier PDS, email me at Amanda@networkintegritysystems.com.

Fact Friday #2

2010-01-29T04:33:00.001-05:00

Welcome to the NIS Blog. Today’s entry contains FAQs Part 2:

Q. Does the Interceptor have an impact on the bandwidth of the network? A: Interceptor is a physical layer device, and does not touch, process or verify the network data or the National Security Information, therefore no bandwidth bottlenecks are created allowing full utilization of the network – up to 10Gbps and beyond.

Q. Is it necessary to perform an auto-configuration before Interceptor can start protecting a network? A: The Interceptor is set at the factory with a default profile that enables it to be placed into service and protect the network immediately. Once installed, performing an autoconfiguration while the unit continues to monitor optimizes the protection profile.

Q. Which organizations have approved Interceptor? A: As an alarmed carrier hardened Protected Distribution System (PDS) compliant with the requirements of NSTISSI 7003, the instruction that governs the transmission of unencrypted National Security Information, INTERCEPTOR™ is a fully approved PDS option. INTERCEPTOR also complies with requirements AFI 33-201 (Air Force), AR 25-2 (Army) and NAVSO P-5239-22 (Navy). It is also listed on the US Air Force CTTA Approved Product List for PDS Alarm Systems as well as the US Navy TEMPEST PDS Approved Product list. INTERCEPTOR has been reviewed by the DISA DSAWG and confirmed as a viable tool for SIPRNet protection subject to approval by local approval authorities.

If you have specific questions you would like us to address, feel free to email me at Amanda@networkintegritysystems.com.

Fact Friday #1

2010-01-22T17:44:00.000-05:00

We get a lot of the same questions from our customers and partners about how Interceptor works. My next few blog posts will attempt to address some of the most commonly asked questions. Here’s FAQs Part 1:

Q. How does Interceptor™ detect an intrusion into a fiber optic cable?
A: Interceptor launches a monitoring signal into a pair of fibers of the optical cable being protected, which turns the entire cable (up to 144 fibers) into a sensor. When any component of the cable is abnormally handled, for instance during an intrusion attempt, the monitored fibers sense the disturbance and Interceptor reports the event.

Q. How does Interceptor distinguish between true intrusions and everyday events that may cause nuisance alarms?
A: Interceptor incorporates a patented Smart Filtering™ technology to “auto-configure” itself and learn a baseline of normal, routine, benign, non-threatening affects upon the cable system. These normal events are thereafter ignored resulting in the elimination of false alarms.

Q. What type of fiber does Interceptor require for monitoring?
A: Interceptor uses the standard communications fibers inside the cable to perform the monitoring, and models are available for dark (unused) or active (transmitting data) fibers.

Q. Does Interceptor protect the cable or just individual fibers?
A: For most cable designs, monitoring as few as 2 fibers within the cable can protect an entire 144-fiber cable. If ingress into the cable is attempted, the protected fibers will sense the disturbance and issue an alarm.

Q. Is an Interceptor required at both ends of the cable run being protected?
A: In the case of dark fiber monitoring, a single Interceptor is required at one end of the cable. For monitoring active fibers, a single Interceptor Plus™ is required at one end of the cable along with a small passive device (Remote Termination Unit) at the far end.

Q. To how many separate buildings or drops can a single Interceptor provide a secure connection?
A: A single Interceptor can provide a secure connection to a minimum of four locations and typically, based upon the network architecture, to as many as sixteen and sometimes up to thirty-two.

If you have specific questions you would like us to address, feel free to email me at Amanda@networkintegritysystems.com.

Interceptor alarmed carrier PDS provides information assurance for National Security Information on SIPRNet and JWICS networks

2009-12-07T23:57:00.003-05:00

Network Integrity Systems recently published a white paper that addresses the advantages of alarmed carrier PDS. Below is a summary of the white paper. Go to http://www.networkintegritysystems.com/IA%20White%20Paper1.pdf for the full text.

With the explosion of SIPRNet and classified information systems throughout DoD and civilian government agencies, the potential vulnerabilities and resulting need for compensating measures to protect our National Security Systems has increased exponentially. With the amplified focus on Information Assurance, the Interceptor™ Optical Network Security System is being increasingly leveraged due to its ability to reduce the cost and complexity of network deployments while also significantly enhancing network security and information assurance.

Current situation:

The Committee on National Security Systems and NSTISSI 7003 provide the overarching national guidance to all DoD and civilian agencies for the protection of wireline and optical fiber Protective Distribution Systems (PDS) used to transmit unencrypted National Security Information. Per NSTISSI 7003 “…the emphasis of a PDS should be placed on ‘detection’ of attempted penetration in lieu of ‘prevention’ of penetration.”
Because of the emphasis on detection, Hardened Carrier PDS installations constructed of rigid metallic conduit require daily periodic visual inspections (PVIs) as the sole means to detect unauthorized access or tampering with the PDS.
With the recent growth of secure networks, the requirement to perform PVIs places a severe strain on manpower and results in infrequent or potentially neglected visual inspections.
To conduct the required PVIs, the PDS must be installed below the ceiling and in plain view. However, this makes the PDS obvious and readily accessible to any and all building occupants and visitors and ultimately more vulnerable to overt and covert attacks.
To prevent unauthorized individuals from entering the PDS system via modular raceway, most agencies have established compensating measures such as the epoxying of all seams or through a more encompassing visual inspection that requires specialized training provided through a third party.

Alarmed carrier PDS solution:

Alarmed Carrier PDS addresses the primary intent of NSTISSI 7003 (detection) by replacing the PVIs with continuous monitoring of the raceway. This results in substantial savings in manpower – but more importantly, it eliminates the risk that an intrusion into the PDS goes unnoticed due to infrequent or neglected human inspections.

An alarmed system provides consistent and persistent protection, and only notifies personnel to perform an inspection in order to investigate potential suspicious activity.

Since alarming the PDS eliminates the requirements to perform daily visual inspections of the PDS, the resources formerly used to conduct that task can be assigned to other activities.
Since visual inspections are not required for an alarmed PDS, the rigid metallic carrier system can be placed in a non-visible location (i.e. below the floor or above the ceiling), which makes it much more difficult for a would-be intruder to gain access.
Since the carrier is out of sight, simple EMT can be used versus more expensive modular raceway products.

Unlike traditional alarm carrier systems that monitor attacks on the raceway, the Interceptor Optical Network Security System monitors fibers within the cables being protected, making the entire cable sensitive to abnormal manipulation and handling.
When the threat level warrants it, some agencies and military branches deem as a compliant PDS, flexible interlocking armored cables monitored by an Interceptor, installed without a rigid metallic carrier.
With the Interceptor PDS and Armored Cable solution, the network cabling, with its continuous protective armor, can now be run from point-to-point with no vulnerable access points at various junctions along the PDS.

An alarmed PDS offers significant advantages over a traditional hardened PDS by automating the inspections necessary to ensure that any penetration is detected, while still providing the robust physical protection of rigid metallic conduit capable of being placed out of sight. When conditions are acceptable, the expenses of a rigid metallic carrier system can be avoided altogether with the use of a monitoring system such as Interceptor and flexible interlocking armored cables, leading to tremendous cost savings and enhanced security.

Welcome to the Network Integrity Systems blog

2009-11-17T13:40:00.005-05:00

This is our first posting, and we are very excited to establish this blog as a forum to update PDS users, potential users and our business partners on NIS’s latest news, as well as educate those seeking to learn more about Alarmed Carrier PDS technology.

As we start adding content, please let us know what other information you would be interested in reading about, and we will do our best to accommodate.

Network Integrity Systems, Inc., specializes in solutions for the protection of secure networks and critical infrastructures. It was founded in 2003 in Conover, N.C., USA, by optical engineers and management personnel from Corning Cable Systems and Norscan, Inc.

In 2002, Norscan, a leader in telephony cable system monitoring products, addressed a requirement from a systems integrator working with the Air Force to develop an improved alarmed carrier PDS solution for protecting fiber optic networks in The Pentagon. This resulted in the development of the Interceptor™ Optical Network Security System, which meets National Security Agency requirements for the protection of fiber-optic data and telecommunications lines transmitting national security information. Network Integrity Systems received subsequentfunding from the U.S. Army Intelligence & Security Command (INSCOM) and the U.S. Air Force Information Warfare Battlelab which accelerated technology development and made enhancements to the Interceptor product line.

Today, Interceptor is the only commercially available alarmed carrier PDS developed under Department of Defense guidance and financing specifically for information assurance and IT security applications. It has been deployed by the Department of Defense, Department of Justice, Department of Homeland Security and all branches of the United States military. In addition to protecting classified networks and national security information, Interceptor has also been deployed to facilitate increased collaboration and information sharing for anti-terrorism activities and to ensure continuity of operations (COOP) and availability of command and control networks, as well as critical infrastructures across the United States.

Network Integrity Systems is a founding partner of Communication Supply Corporation’s Secure(it) program – focused on enhancing the security and availability of high assurance networks and facilities throughout the Department of Defense and federal government.

For more information, visit www.networkintegritysystems.com, e-mail us at info@networkintegritysystens.com or call 877-NIS-4PDS.